EUVD-2026-70593
GHSA-jw45-8p57-gxfw
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Unauthenticated network XSS with scope change; UI:R required for victim rendering; all impacts Low as script execution yields limited direct control.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Calculation For Contact Form 7 <= 1.0 versions.
AnalysisAI
Unauthenticated cross-site scripting (XSS) in the Calculation For Contact Form 7 WordPress plugin (all versions up to and including 1.0) allows a remote unauthenticated attacker to inject malicious scripts into pages viewed by other users. With no privileges required and a scope change confirmed by the CVSS vector (S:C), a successful exploit executes arbitrary JavaScript in the victim's browser context, enabling session hijacking, credential harvesting, or UI redressing. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target WordPress site must have the Calculation For Contact Form 7 plugin (version <= 1.0) installed and active, with at least one Contact Form 7 form using the calculation feature present on a publicly accessible page. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.1 score reflects a meaningful but not critical risk level: the attack is network-accessible, requires no authentication, and has low complexity, but user interaction is required and all impact dimensions (C:L/I:L/A:L) are capped at Low. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis - the Patchstack advisory covers all versions through 1.0 with no confirmed fix version in the available input data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress installations using Calculation For Contact Form 7 and disable the plugin immediately to prevent exploitation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today